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SYSTEMS AND METHODS FOR MANAGING FAULTS IN A NETWORK 

FIELD OF THE INVENTION 

The present invention relates generally to networks and, more particularly, to 
systems and methods for improving network management. 

BACKGROUND OF THE INVENTION 

Presently, the act of troubleshooting a network is a time-consuming task. 
Several solutions exist that aid network administrators in managing faults in a 
network by providing various tools for collecting and viewing individual faults (i.e., 
alarms) and performing a set of operations on them (e.g., acknowledge, clear, escalate, 
etc.). Typically, these views are variations on tabular displays (i.e., rows of alarms) 
and two-dimensional (2D) topology displays (i.e., network maps). 

These tools are generally adequate for small-to-medium scale network 
operation centers, such as network operation centers with less than 100 alarms/per 
shift/per monitoring technician, moderate requirements on the frequency of network 
upgrades, etc. In environments with a large number of network elements and high 
alarm rates, however, these tools are often limited with respect to their ability to 
display relevant, real-time, fault information to monitoring technicians and network 
operation center's management. These limitations often invalidate the use of available 
tools in support of large-scale network operations. 

Therefore, there exists a need for systems and methods that facilitate the 
management of a network. 
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SUMMARY OF THE INVENTION 

A system and method consistent with the present invention address this and 
other needs by providing a mechanism that facilitates network management. 

In accordance with the purpose of the invention as embodied and broadly 
described herein, a method for managing a network includes providing a first list of 
events occurring in the network; simultaneously providing a second list of events 
occurring in the network, the second list comprising a predetermined number of most 
recent events; and managing the network using the first and second lists. 

In another implementation consistent with the present invention, a device for 
managing a network having a plurality of network elements includes a memory and a 
processor. The processor provides a list of identifiers associated with the plurality of 
network elements, where each network element identifier is associated with a state 
indication. 

In yet another implementation consistent with the present invention, a method 
for managing a network having a plurality of network devices includes associating 
events in the network with one of the plurality of network devices; providing a 
geographical map, the geographical map displaying locations of each of the plurality 
of network devices and indicating which of the plurality of network devices are 
associated with at least one event; and managing the network using the geographical 
map. 

In still yet another implementation consistent with the present invention, a 
device for managing a network having a plurality of network elements includes a 
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memory and a processor. The processor associates each network element with one of 
a plurality of logical planes and provides a network map. The network map displays 
relationships between the plurality of logical planes and those network elements 
associated with the plurality of logical planes. 

In still another implementation consistent with the present invention, a system 
for managing a network having a plurality of network elements includes a user device 
and a server. The user device provides a user with a list of network management 
options, the options including a network element diagnostic option, a network 
summary option, a geographical network management option, a three-dimensional 
network management option, transmits, in response to a selection of an option by the 
user, a request for current network information, provides the user with current 
network information according to the selected option. The server receives the request 
for current network information and transmits current network information to the user 
device. 

BRIEF DESCRIPTION OF THE DRAWINGS 
The accompanying drawings, which are incorporated in and constitute a part of 

this specification, illustrate an embodiment of the invention and, together with the 

description, explain the invention. In the drawings, 

FIG. 1 illustrates an exemplary system in which systems and methods, 

consistent with the present invention, may be implemented; 

FIG. 2 illustrates an exemplary server consistent with the present invention; 
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FIGS. 3 A and 3B illustrate exemplary databases consistent with the present 

invention; 

FIG. 4 illustrates an exemplary network operations center consistent with the 
present invention; 

5 FIGS. 5-8 illustrate exemplary graphical user interfaces, consistent with the 

present invention, that facilitate network management operations; 

FIG. 9 illustrates an exemplary process, consistent with the present invention, 
that improves management of a network; and 
^ FIG. 10 illustrates an exemplary graphical user interface that may be provided 

; , JO to the user of a network operations center. 

1J DETAILED DESCRIPTION 

vJ The following detailed description of the invention refers to the accompanying 

\Z drawings. The same reference numbers in different drawings identify the same or 

TT similar elements. Also, the following detailed description does not limit the 

r|5 invention. Instead, the scope of the invention is defined by the appended claims. 

Systems and methods, consistent with the present invention, provide a 
mechanism to improve network management. The mechanism simplifies the manner 
in which a user (e.g., a network engineer) analyzes the operation of the network by 
providing the user with several graphical user interfaces. The graphical user interfaces 
20 allow the user to manage the network in a variety of ways. 

EXEMPLARY SYSTEM 
FIG. 1 illustrates an exemplary system 100 in which systems and methods, 
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consistent with the present invention, that improve management of a network may be 
implemented. In FIG. 1, system 100 includes a network 110, points of presence 
(POPs) 112-122, a server 130, a network operations center (NOC) 140, and a group of 
nodes 161-169 that may be directly connected to a POP 1 12-122 or connected via a 
customer network 151-153. 

The network 1 10 may include, for example, the Internet, an intranet, a local 
area network (LAN), a metropolitan area network (MAN), a wide area network 
(WAN), or the like. In fact, the network 110 may include any type of network or 
combination of networks that permits routing of information from a particular source 
to a particular destination. 

The POPs 112-122 may include conventional routers that decide, based on 
routing protocols (e.g., a frame relay protocol) and routing tables, how and where to 
send packets of information. Each POP 1 12-122 may also include one or more 
servers, such as an e-mail server or a World Wide Web server. Each POP 112-122 
may be implemented via hardware and/or software. 

The server 130 may include any type of computer system, such as a 
mainframe, minicomputer, or personal computer, capable of connecting to the 
network 110 to communicate with other devices, such as the network operations 
center 140, in the system 100. In alternative implementations, the server 130 may 
include a mechanism for directly connecting to the network operations center 140 or 
may be included within network operations center 140. The server 130 may also 
include a mechanism for communicating with the nodes 161-169. The server 130 may 
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transmit data over network 1 10 or receive data from the network 110 via a wired, 

wireless, or optical connection. 

The network operations center 140 may include any type of computer system, 
such as a mainframe, minicomputer, personal computer, laptop, personal digital 
assistant, or the like, capable of connecting to the network 1 10. The network 
operations center 140 monitors and manages the operation of the network 110. The 
network operations center 140 may transmit data over the network 1 10 or receive data 
from the network 110 via a wired, wireless, or optical connection. 

The customer networks 151-153 may include any type of local network, such 
as a LAN, MAN, WAN, or the like, that permits routing of information packets 
among the nodes connected to the respective network. The nodes 161-169 may 
include computers, such as workstations and servers, or any other type of device that 
has a network interface card (NIC), such as a printer or modem. Moreover, the nodes 
161-169 may include devices, such as a personal digital assistant, that connect to a 
particular local network via a wireless connection. 

The number of components illustrated in FIG. 1 is provided for simplicity. In 
practice, a typical system 100 may include a larger or smaller number of networks, 
POPs, servers, network operations centers, customer networks, and/or nodes. 
EXEMPLARY SERVER CONFIGURATION 

FIG. 2 illustrates an exemplary server 130 consistent with the present 
invention. The server 130 includes a bus 210, a processor 220, a memory 230, an 
input device 240, an output device 250, and a communication interface 260. The bus 
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210 may include one or more conventional buses that permit communication among 
the components of the server 130. 

The processor 220 may include any type of conventional processor or 
microprocessor that interprets and executes instructions. The memory 230 may 
include a random access memory (RAM) or another type of dynamic storage device 
that stores information and instructions for execution by the processor 220; a read 
only memory (ROM) or another type of static storage device that stores static 
information and instructions for use by the processor 220; and/or some other type of 
magnetic or optical recording medium and its corresponding drive. 

The input device 240 may include one or more conventional mechanisms that 
permit an operator to input information to the server 130, such as a keyboard, a 
mouse, a pen, voice recognition and/or biometric mechanisms, and the like. The 
output device 250 may include one or more conventional mechanisms that output 
information to the operator, including a display, a printer, a speaker, etc. The 
communication interface 260 may include any transceiver-like mechanism that 
enables the server 130 to communicate with other devices and/or systems. For 
example, the communication interface 260 may include mechanisms for 
communicating with the network operations center 140 via a network, such as 
network 110 (FIG. 1). 

Execution of the sequences of instructions contained in memory 230 causes 
processor 220 to provide current network information as described below. In 
alternative embodiments, hard-wired circuitry may be used in place of or in 
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combination with software instructions to implement the present invention. Thus, the 
present invention is not limited to any specific combination of hardware circuitry and 
software. 

The server 130, consistent with the present invention, provides information 
5 from one or more databases to a graphical user interface at the network operations 

center 140. The database may be stored at the server 130 (e.g., in memory 230) or 
externally from server 130. 

FIGS. 3A and 3B illustrate exemplary databases 310 and 330, respectively, 
O consistent with the present invention. It will be appreciated that server 130 may 

;40 consist of other databases stored locally or distributed throughout the network 110. 
y As illustrated, database 310 includes a group of entries 305 that relate to 

y events that occurred in the network 110. Each entry 305 may include information 

stored in one more of the following exemplary fields: an alarm type field 31 1, an 
^ optional number field 312, a state field 313, an action field 314, a time field 315, a 

r|5 date field 316, a network element (NE) identifier (ID) field 317, and an alarm 

description field 318. Database 310 may contain additional or different fields that 
would aid the server 130 in searching and sorting information in database 310. While 
information for a single network element (ABCDEFG03H) is illustrated in FIG. 3 A, it 
will be appreciated that database 310 may include information for more than one 
20 network element. 

The alarm type field 311 may store an identifier indicating the type of alarm 
associated with a network element. Typical alarms may include, for example, a fire 
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alarm, a port alarm, a line alarm, and the like. The alarm type field 311 may include a 
subfield (not shown) that stores a variable indicative of the severity of a corresponding 
alarm. Alarm severity categories might include criticial, major, minor, and 
informational. The optional number field 312 may store an indication of the number 
5 of alarms represented by a single alarm icon. 

The state field 313 may store an indication, represented by one or more letters, 
of the state of the alarm. For example, an "A" may represent an acknowledged alarm, 
an "E" may represent an escalated alarm state, an r, AE" may represent an alarm that 
O has been acknowledged and escalated, and a "C" may represent that an alarm has been 

JO cleared. The state field 313 may be left blank to indicate that an alarm has not been 
| j acknowledged, escalated, or cleared. The state field 313 may include one or more 

y variables to indicate that the alarms associated with a network element are in the same 

M state or in different states. 

The action field 3 14 may store an indication of the type of action taken on an 
3? alarm. For example, an indication of "PA" may represent that activity for this 

particular alarm is planned. The action field 314 may be left blank when no action has 
been taken on the alarm. The time field 315 may store an indication of the time that 
the alarm occurred. The time may, for example, be stored in HH:MM:SS format or 
some other format. The date field 316 may store an indication of the date that the 
20 event occurred. The date may, for example, be stored in MM/DD/YYYY format or 

some other format. 

The NE ID field 317 may store an identifier of the network element on which 
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the alarm occurred. The NE ID field 317 may, for example, store the identifier as a 
Common Language Location Identifier (CLLI). Other techniques for identifying the 
network element may alternatively be used. 

The alarm description field 318 may store information describing the problem 
associated with the alarm. The alarm description field 318 may include, for example, 
an indication that a fire has been detected at a particular network element, an identity 
of a particular port that has failed, or the like. The database 310 may also include an 
acknowledgement field (not shown) that stores an identifier associated with the user 
(if any) that acknowledged the alarm. 

Database 330 (FIG. 3B) may include a group of entries 325 that relate to 
events that occurred in the network 110. Each entry 325 may include information 
stored in one or more of the following exemplary fields: a network element field 331, 
an ID field 332, an alarms field 333, a tickets (TT) field 334, a held alarms (HA) field 
335, a notes field 336, an incidents (IN) field 337, a users field 338, an escalated 
alarm field 339, and a last modified field 340. Database 330 may include additional 
or different fields that would aid the server 130 in searching and sorting information 
in the database 330. 

The network element field 331 may store one or more identifiers representing 
the network element type and its alarm state. A typical network element type may 
include, for example, a frame relay switch, an Asynchronous Transfer Mode (ATM) 
switch, an Internet Protocol (IP) router, or the like. The network element type may be 
associated with an identifier representing the network element's alarm state. Typical 
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alarm states could include critical, major, minor, and informational. The ID field 332 
may store an identifier of the network element. Similar to database 310, the identifier 
may be stored as a CLLI. 

The alarms field 333 may store information regarding the states of the alarms 
associated with a particular network element. As illustrated, the alarms field 333 may 
include a critical state (C) subfield, a major state (MA) subfield, a minor state (MI) 
subfield, and an informational state (I) subfield. The critical state, major state, minor 
state, and informational state subfields may store a value indicative of the number of 
alarms associated with a particular network element that is in that particular state. 
The alarms field 333 may also include a total alarms subfield that stores a value 
representing the total number of alarms associated with a particular network element. 
As illustrated, the network element ABCDEFG03H is associated with 130 total 
alarms, of which 32 are critical, 35 are major, 54 are minor, and 9 are informational. 

The tickets field 334 may store an indication of the number of outstanding 
trouble tickets that are associated with a network element. The held alarms field 335 
may store an indication of the number of outstanding alarms that are on hold. The 
notes field 336 may store an indication of the number of outstanding notes associated 
with a particular network element. The notes field 336 may also store the actual notes 
for the particular network element. 

The incidents field 337 may store an indication of the number of outstanding 
incident reports associated with a network element. The users field 338 may store an 
indication of the number of operators that are currently monitoring a particular 
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network element. The escalated alarms field 339 may store an indication of the 

number of escalated alarms associated with a particular network element. The last 

modified field 340 may store the date and time of the last time in which the 

information in fields 332-339 for a particular network element has been modified. 

EXEMPLARY NETWORK OPERATIONS CENTER 

FIG. 4 illustrates an exemplary network operations center 140 consistent with 
the present invention. The network operations center 140 may include a bus 402, a 
processor 404, a main memory 406, a ROM 408, a storage device 410, an output 
device 412, an input device 414, and a communication interface 416. The bus 402 
may include one or more conventional buses that permit communication among the 
components of the network operations center 140. 

The processor 404 may include any type of conventional processor or 
microprocessor that interprets and executes instructions. The main memory 406 may 
include a RAM or another type of dynamic storage device that stores information and 
instructions for execution by the processor 404. Main memory 406 may also be used 
to store temporary variables or other intermediate information during execution of 
instructions by processor 404. 

ROM 408 may include a conventional ROM device and/or another type of 
static storage device that stores static information and instructions for processor 404. 
The storage device 410 may include a magnetic disk or optical disk and its 
corresponding drive and/or some other type of magnetic or optical recording medium 
and its corresponding drive for storing information and instructions. 
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The output device 412 may include one or more conventional mechanisms that 
output information to an operator, including a display, a printer, a speaker, etc. The 
input device 414 may include one or more conventional mechanisms that permit the 
operator to input information to the system 140, such as a keyboard, a mouse, a pen, 
voice recognition and/or biometric mechanisms, etc. The communication interface 
416 may include any transceiver-like mechanism that enables the network operations 
center 140 to communicate with other devices and/or systems, such as the server 130. 
For example, the communication interface 416 may include a modem or an Ethernet 
interface to a network. Alternatively, communication interface 416 may include other 
mechanisms for communicating via a network, such as network 1 10. 

The network operations center 140 improves network troubleshooting in 
response to processor 404 executing sequences of instructions contained in a 
computer-readable medium, such as memory 406. Such instructions may be read into 
memory 406 from another computer-readable medium, such as a storage device 410, 
or from a separate device via communication interface 416. A computer-readable 
medium may include one or more storage devices and/or carrier waves. Execution of 
the sequences of instructions contained in memory 406 causes processor 404 to 
perform the process steps that will be described hereafter. In alternative 
embodiments, hard-wired circuitry may be used in place of or in combination with 
software instructions to implement the present invention. Thus, the present invention 
is not limited to any specific combination of hardware circuitry and software. 
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The network operations center 140, consistent with the present invention, 
provides network management information to an operator via a group of graphical 
user interfaces. The graphical user interfaces may be provided to the operator at, for 
example, the network operation centers output device 412 or at an output device 
located remotely therefrom. 

FIGS. 5-8 illustrate exemplary graphical user interfaces, consistent with the 
present invention, that facilitate network management operations. FIG. 5 illustrates a 
first exemplary graphical user interface 500 consistent with the present invention. In 
FIG. 5, the exemplary graphical user interface 500 provides an active alarm interface 
that includes an active alarm window 505 and a most recent alarm window 510 for 
one or more network elements. For simplicity, the active alarm interface 500 provides 
alarms associated with a single network element, namely network element 
ABCDEFG03H. 

The active and most recent alarm windows 505 and 510 include the following 
exemplary fields: a type field, a number (NO) field, a state (ST) field, an action (AT) 
field, a time field, a date field, a network element (NE) identifier (ID) field, a detailed 
alarm description field, and an acknowledge field. The type field may include an 
identifier, in the form of one or more words or icons, indicating the type of alarm 
associated with a network element. As illustrated, typical alarms may include, for 
example, a fire alarm, a port alarm, a line alarm, and the like. To illustrate the 
severity of a particular alarm, the identifiers may be of different colors. For example, 
dark red may be used to represent a critical alarm, red may be used to represent a 
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major alarm, yellow may be used to represent a minor alarm, and blue may be used to 
represent an informational alarm. 

The number field may include an indication of the number of alarms 
represented by a single alarm identifier in the type field. The state field may include 
an indication, represented by one or more letters, of the state of a particular alarm. 
For example, an "A" may represent an acknowledged alarm, an "E" may represent an 
escalated alarm state, an "AE" may represent an alarm that has been acknowledged 
and escalated, and a "C" may represent that an alarm has been cleared. Uppercase 
letters in the state field may indicate that all alarms associated with a particular 
network element are in the same state. Lowercase letters may indicate that some, but 
not all, of the alarms are in the specified state. The state field may be left blank to 
indicate that an alarm has not been acknowledged, escalated, or cleared. It will be 
appreciated that other indications may alternatively be used. 

The action field may include an indication of the type of action taken on an 
alarm. For example, an indication of "PA" may represent that activity for this 
particular alarm is planned. The action field may be left blank when no action has 
been taken on the alarm. The time field may include the time that a particular alarm 
occurred. The time may, for example, be represented in HH:MM:SS format or any 
other format. The date field may include the date that the alarm occurred. The date 
may, for example, be represented in MM/DD/YYYY format or any other format. 

The NE ID field may include an identifier of the network element on which the 
alarm occurred. The NE ID field may, for example, include the identifier as a 
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Common Language Location Identifier (CLLI), Other techniques for identifying the 
network element may alternatively be used. If the active and most recent alarm 
windows 505 and 510 include information for a single network element, as in FIG. 5, 
the NE ID field may be removed. 

The alarm description field may include information describing the problem 
associated with a particular alarm. The alarm description field may include, for 
example, an indication that a fire has been detected at a particular network element, an 
identity of a particular port that has failed, and the like. 

The acknowledge field may include one or more initials of an operator that has 
acknowledged a particular alarm. The active and most recent alarm windows 505 and 
510 may include other fields (not shown) that aid a network operator in managing or 
troubleshooting a network, such as network 1 10. 

The active alarm window 505 provides the operator with a listing of active 
alarms. As new alarms occur in the network 110, the older alarms are scrolled out of 
the window 505. Through the use of the scroll bar, the operator may view alarms that 
have scrolled out of the window 505. 

The most recent alarm window 510 displays the most recent alarms in the 
network 110. The number of most recent alarms displayed may be configured by the 
operator. When monitoring large networks with high alarm volume, the most recent 
alarm window 510 ensures that critical alarms (e.g., outages) always show up in the 
visible area on the operator's screen. Conventional troubleshooting techniques 
typically have a single active workspace, such as window 505, to view alarms and act 
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on them. It is likely that the newly arrived alarm will get scrolled-off from the visible 
area in the window, as operators are working on alarms that already exist in the 
window. 

If an operator wants to act on a new alarm immediately upon arrival (e.g., 
acknowledge it), the operator can select the alarm row in the most recent alarm 
window 510 and the same alarm instance is automatically selected in the active alarm 
window 505. The operator may then proceed to acknowledge the alarm in the active 
alarm window 510. 

FIG. 6 illustrates an alternative exemplary graphical user interface 600 
consistent with the present invention. As illustrated, the graphical user interface 600 
includes a trouble information matrix that provides an operator with a summary view 
of each network element in a system, such as system 100. The trouble information 
matrix 600 may include the following exemplary fields: a network element (NE) field, 
an identifier (ID) field, an alarms field, a tickets field, a held alarms field, a notes 
field, an incidents (IN) field, a users (US) field, an escalated alarms (EA) field, and a 
last modified field. 

The network element field may include one or more identifiers, in the form of 
one or more words or icons, representing a network element type and its alarm state. 
As illustrated, network element types may include, for example, a frame relay (FR) 
switch, an Asynchronous Transfer Mode (ATM) switch, an Internet Protocol (IP) 
router, or the like. To readily identify the severity of the alarms associated with a 
particular network element, the network element identifiers may be associated with a 
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color. For example, dark red may be used to represent a critical alarm, red may be 
used to represent a major alarm, yellow may be used to represent a minor alarm, and 
blue may be used to represent an informational alarm. When a network element is 
associated with alarms of differing severity, the network element may be associated 
with a color indicative of the alarm having the highest severity. 

The ED field may include an identifier of the network element. In an 
implementation consistent with the present invention, the identifier may be displayed 
as a CLLL The alarms field may include information regarding the states of the 
alarms associated with a particular network element. The alarms field may include a 
critical state (CR) subfield, a major state (MAJ) subfield, a minor state (MIN) 
subfield, an informational state (INFO) subfield, and a total alarms (TOTAL) subfield. 
The critical state, major state, minor state, and informational state subfields may 
include a value indicative of the number of alarms associated with a particular 
network element that is in that particular state. The total alarms subfield may include 
a value indicative of the total number of alarms associated with a particular network 
element. As illustrated, the network element ABCDEFG03H is associated with 130 
total alarms, of which 32 are critical, 35 are major, 54 are minor, and 9 are 
informational. 

The tickets field may include an indication of the number of outstanding 
trouble tickets that are associated with a network element. The held alarms field may 
include an indication of the number of outstanding alarms, associated with a network 
element, that are on hold. The notes field may include an indication of the number of 
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outstanding notes associated with a particular network element. 

The incidents field may include an indication of the number of outstanding 
incident reports associated with a network element. The users field may include an 
indication of the number of operators that are currently monitoring the network 
element. The escalated alarms field may include an indication of the number of 
alarms associated with a particular network element that have an escalated status. The 
last modified field may include the date and time of the last time in which information 
for a particular network element has been modified. 

The trouble information matrix 600 provides an operator with the status of 
events associated with selected network elements and allows the operator to quickly 
access information in a way not available in conventional systems. For example, 
selecting a network element in the network element field or on one of the numbers in 
the alarm field, the operator may be taken to the active alarm interface 500 where an 
alarm may be acknowledged or acted upon. An operator may select a network 
element or alarm number by, for example, by a left-click or double-click operation. 
By selecting a number in the tickets field, the operator may be provided, via, for 
example, a trouble ticket viewer, with a more detailed view of the the trouble tickets 
associated with a particular network element. 

By selecting a number in the held alarms field, the operator may be taken to a 
more detailed view of the alarms that are currently on hold for a particular network 
element. Similarly, by selecting a number in the notes field, the operator may be 
taken to a notes viewer in which the operator can read the notes associated with a 
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particular network element. More detailed views of the information in the users and 
escalated alarms fields may be obtained by selecting a number in those fields. For 
example, an operator may be provided with a list of names and contact information for 
users that are monitoring a particular network node by selecting the users number in 
the users field. 

FIG. 7 illustrates another exemplary graphical user interface 700 consistent 
with the present invention. In FIG. 7, the graphical user interface 700 includes a 
geographical map 710 that illustrates points of presence and individual network 
elements according to their geographical location. The graphical user interface 700 
also visually maps outstanding trouble tickets to objects displayed in the geographical 
map 710. If a particular point of presence has outstanding trouble tickets on any 
network elements housed therein, a small "T" icon may be displayed next to the point 
of presence icon. 

By selecting a particular point of presence or network element that is 
associated with a trouble ticket, the graphical user interface 700 may provide an 
operator with a number of options. In one option, the graphical user interface 700 
may provide the operator with a more detailed view 720 of the geographical area 
affected. The operator may also be provided with a "Show Trouble Tickets" menu 
that allows for trouble tickets to be viewed in a trouble ticket management system of 
the operator's choice (e.g., Remedy). Similar viewing options may be provided for 
individual network elements as users "drill down" into a point of presence by selecting 
the point of presence on the geographical map 710. 
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FIG. 8 illustrates yet another exemplary graphical user interface 800 consistent 
with the present invention. In FIG. 8, the graphical user interface 800 allows an 
operator to visualize and navigate a network, such as network 1 10, in three 
dimensions. The graphical user interface 800 may, for example, be provided as a 
standard Web browser virtual reality modeling language (VRML) plug-in. 

The graphical user interface 800 includes a network topology window 810, 
navigation tools 820, and management tools 830, In the network topology window 
810, the network may be broken down into a group of logical network planes (e.g., 
Switching planes, Transmission planes, Signaling planes, Customer Access planes, 
etc.). This provides a network operator with a convenient way to analyze a particular 
portion of the network of interest to that operator. 

The network topology window 810 also illustrates how the individual logical 
planes and the network elements within those planes are interconnected. A network 
operator of the system may for example, define the logical planes and the association 
between planes and network elements. Network elements displayed in the network 
topology window 810 may be colored according to the their alarm status in real-time. 
By displaying the alarm status of network elements in the network and the 
interconnection of those network elements to other network elements in the network 
110, network operators may quickly determine problem areas and how they affect the 
rest of the network 110. 

The navigation tools 820 allow a network operator to "walk" the network in 
the network topology window 810. The operator may zoom in and out in order to get 
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a closer or more distant view of the network, rotate the logical planes in the network, 
and the like. 

The management tools 830 include a NetPlanes button, a Deselect button, a 
LiveAlarms button, an AlarmMatrix button, a PerfGraph button, a Trace button, and a 
Quit button. The NetPlanes button allows for different logical planes to be toggled in 
and out of the network topology window 810, The operator may select one or more 
network elements in the network topology window 810 by, for example, clicking on 
them. The Deselect button allows for selected network elements to be deselected. As 
in more traditional two-dimensional network topology displays, an operator may 
select network elements in 3D space and invoke operations on them or open other 
informational and real-time windows by clicking on the "LiveAlarms," 
"AlarmMatrix," or "PerfGraph" buttons. By selecting a network element on one plane 
and clicking on the "Trace" button, all "affected" network elements and links on other 
planes and links between planes will be highlighted. The "Quit" button exits the 3D 
view and returns to a login screen. 

Unlike standard two-dimensional map representations of network topologies, 
the graphical user interface 800 offers the following unique advantages. The network 
topology window 810 automatically controls the level of detail of displayed 
information. For example, as operators "walk the network," the labels for network 
elements in the current locale of the operator's view get displayed automatically. This 
allows for uncluttered displays of large network data sets with only relevant 
information shown in greater detail. 
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The network topology window 810 allows operators to visualize network 
topology more naturally. The network topology window 810 shows relationships 
between logical layers of the network and helps operators visually relate faults to 
network topology faster. Once a problem is isolated to a particular network layer, an 
operator can further focus on network elements on this layer and turn off displaying 
other layers. 

Unlike conventional network displays, operators can stay within the context of 
a single web browser frame as they navigate the network. They do not have to "pop- 
up" numerous windows on the desktop to "drill down the network" (e.g., going from a 
customer circuit view into the SONET ring that carries that circuit). 

EXEMPLARY PROCESSING 

FIG. 9 illustrates an exemplary process, consistent with the present invention, 
to improve management of a network, such as network 1 10. Processing may begin 
with a user (e.g., a network engineer) initializing a management process at the 
network operations center 140 [act 905]. This initialization procedure may involve 
the user double-clicking an icon on a screen at the network operations center 140, 
typing in a command, or some other well-known technique. The initialization 
procedure may also involve some type of well-known log-in process by which the user 
may enter an identifier and password that are authenticated by the network operations 
center 140. 

The network operations center 140 may then provide a menu of possible 
network management options [act 910]. FIG. 10 illustrates an exemplary graphical 



-23- 



EXPRESS MAIL NO. EL029404783US PATENT 

Docket No. 00-8008 

user interface 1000 that may be provided to the user of network operations center 140. 
As illustrated, the graphical user interface 1000 requests the selection of a network 
management option. The options may include a network element management option, 
a trouble information matrix option, a geomap-integrated trouble view option, and a 
three-dimensional (3D) network topology management option. 

Assume that the user selects the network element management option [act 
920]. The network operations center 140 may request the user to provide the identity 
a network element of interest [act 922]. Upon entry of a network element identifier, 
the network operations center 140 may request information about the network element 
from the server 130 [act 924]. In response, the server 130 may transmit information, 
for example, from database 310, that pertains to the requested network element [act 
926]. 

Upon receipt of the information from server 130, the network operations 
center 140 may provide the user with the requested information [act 928]. The 
information may be provided, for example, via the graphical user interface 500 
illustrated in FIG. 5. As illustrated therein, the graphical user interface 500 may 
provide the user with detailed alarm information for a particular network element 
(e.g., ABCDEFG03H). The user may monitor alarms associated with the requested 
network element in an active alarm window 505. The user may also monitor alarms 
that have most recently occurred in a most recent alarms window 510. The user may 
use the graphical user interface 500 to manage the network [act 960]. 

Assume that the user selects the trouble information matrix option [act 930]. 
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Upon the selection of the trouble information matrix option, the network operations 
center 140 may request current network information from the server 130 [act 932]. In 
response, the server 130 may transmit information from database 330 and/or database 
310 to the network operations center 140 [act 934]. 

Upon receipt of the information from server 130, the network operations 
center 140 may provide the user with the requested information [act 936]. The 
information may be provided, for example, via the graphical user interface 600 
illustrated in FIG. 6. As illustrated therein, the graphical user interface 600 may 
provide the user with a summary view of the state of each network element in the 
network. This allows the user to readily determine the number of alarms associated 
with a particular network element and the severity of those alarms. The graphical user 
interface 600 simplifies management of large-scale telecommunications networks by 
allowing the user to quickly retrieve detailed information about any network element 
in the network. The user may use the graphical user interface 600 to manage the 
network [act 960]. 

Assume that the user selects the geomap-integrated trouble view option [act 
940]. Upon the selection of the geomap-integrated trouble view option, the network 
operations center 140 may request current network information from the server 130 
[act 942]. In response, the server 130 may transmit information from database 330 
and/or database 310 to the network operations center 140 [act 944]. 

Upon receipt of the information from server 130, the network operations 
center 140 may provide the user with the requested information [act 946]. The 



-25- 



EXPRESS MAIL NO. EL029404783US PATENT 

Docket No. 00-8008 

information may be provided, for example, via the graphical user interface 700 

illustrated in FIG, 7. As illustrated therein, the graphical user interface 700 may 

provide the user with geographic locations of points of presence and network elements 

in the network. The graphical user interface 700 may also map trouble tickets to 

objects in the network. The user may readily determine the geographic location of 

alarms in the network. The user may use the graphical user interface 700 to manage 

the network [act 960]. 

Assume that the user selects the 3D network topology option [act 950], Upon 
the selection of the 3D network topology option, the network operations center 140 
may request current network information from the server 130 [act 952]. In response, 
the server 130 may transmit information from database 330 and/or database 310 to the 
network operations center 140 [act 954]. 

Upon receipt of the information from server 130, the network operations 
center 140 may provide the user with the requested information [act 956]. The 
information may be provided, for example, via the graphical user interface 800 
illustrated in FIG. 8. As illustrated therein, the graphical user interface 800 may 
provide the user with a real-time, three-dimensional model of the network. Network 
elements in the model may be shaded in order to depict current states of the network 
elements. The graphical user interface 800 provides the user with the ability to 
navigate through the network, to represent the network as a logical layer of planes 
(e.g., customer access, switching, transmission, etc.), and to readily determine how a 
particular alarm affects the overall network. The user may use the graphical user 
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interface 800 to manage the network [act 960]. 

CONCLUSION 

Systems and methods, consistent with the present invention, provide a 
mechanism to improve network management. The mechanism provides a user (e.g., a 
network engineer) with several graphical user interfaces with which to manage 
network operations. The graphical user interfaces allow the user to easily assimilate a 
large amount of information thereby facilitating the management of any sized 
network. 

The foregoing description of exemplary embodiments of the present invention 
provides illustration and description, but is not intended to be exhaustive or to limit 
the invention to the precise form disclosed. Modifications and variations are possible 
in light of the above teachings or may be acquired from practice of the invention. For 
example, the described implementation includes software and hardware, but elements 
of the present invention may be implemented as a combination of hardware and 
software, in software alone, or in hardware alone. Also, while a series of steps has 
been described with regard to FIG. 9, the order of the steps may be varied in other 
implementations consistent with the present invention. No element, step, or 
instruction used in the description of the present application should be construed as 
critical or essential to the invention unless explicitly described as such. 

The scope of the invention is defined by the following claims and their 
equivalents. 



-27- 



EXPRESS MAIL NO. EL029404783US 



PATENT 

Docket No. 00-8008 



WHAT IS CLAIMED IS: 

1 . A method for managing a network, comprising: 

providing a first list of events occurring in the network; 

simultaneously providing a second list of events occuning in the 

network, the second list comprising a predetermined number of most recent events; 
and 

managing the network using the first and second lists. 

2. The method of claim 1 further comprising: 

setting a number of events to be provided in the second list. 

3. The method of claim 1 further comprising: 
selecting an event in the second list, and 

automatically selecting, in response to selecting an event in the second 
list, an equivalent event in the first list. 

4. The method of claim 3 further comprising: 
acknowledging the equivalent event in the first list. 

5. The method of claim 1 wherein the first and second lists include events 
relating to at least one network element in the network. 
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6. A system for managing a network, comprising: 
means for providing a first list of events in the network; 
means for simultaneously providing a second list of events in the 

network, the second list comprising a predetermined number of most recent events; 
5 and 

means for managing the network using the first and second lists. 

7. A system for managing a network, comprising: 

a user device configured to transmit a request for current network 
information, provide a first list of events occurring in the network, and simultaneously 
provide a second list of events occurring in the network, the second list comprising a 
5 number of most recent events; and 

a server configured to receive the request for current network 
information and provide the current network information to the user device. 

8. The system of claim 7 wherein the request includes at least one 
network identifier. 

9. The system of claim 8 wherein, when providing the current network 
information, the server is configured to: 
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provide current network information relating to the at least one 

network identifier. 

10. The system of claim 7 wherein the number of most recent events 
provided in the second list is set by a user. 

11. The system of claim 10 wherein the user device is further configured 

to: 

select an event in the second list, and 

automatically select, in response to selecting an event in the second list, 
5 an equivalent event in the first list. 

12. A computer-readable medium containing instructions for controlling at 
least one processor to perform a method for managing a network, the method 
comprising: 

providing a first list of events in the network; 
5 simultaneously providing a second list of events in the network, the 

second list comprising at least one most recent event; and 

managing the network using the first and second lists. 

13. The computer-readable medium of claim 12 wherein the method 
further comprises: 
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setting a number of events to be provided in the second list. 

14. A device for managing a network having a plurality of network 
elements, comprising: 

a memory configured to store instructions; and 
a processor configured to execute the instructions to provide a list of 
5 identifiers associated with the plurality of network elements, each network element 
identifier being associated with a state indication. 

15. The device of claim 14 wherein the processor is further configured to: 
provide, for each network element identifier, a total number of alarms 

associated with each of the plurality of network elements. 

16. The device of claim 15 wherein the processor is further configured to: 
provide, for each network element identifier, a value indicating a 

quantity of major alarms associated with a respective network element, and 

provide, for each network element identifier, a second value indicating 
5 a quantity of minor alarms associated with a respective network element. 

17. The device of claim 14 wherein the processor is further configured to: 
provide, for each network element identifier, a value representing a 

number of users monitoring a respective network element. 



EXPRESS MAIL NO. EL029404783US 



PATENT 

Docket No. 00-8008 



18. The device of claim 17 wherein the processor is further configured to: 
provide, in response to selecting the value representing the number of 

users monitoring a network element, contact information for each user. 

19. The device of claim 14 wherein the processor is further configured to: 
provide, for each network element identifier, a value representing a 

number of escalated alarms associated with a respective network element. 

20. A method for managing a network having a plurality of network 
elements, comprising: 

receiving a request for network information; 

providing a list of network element identifiers associated with the 
plurality of network elements, the list indicating a state of each of the plurality of 
network elements; and 

managing the network using the list. 

2 1 . The method of claim 20 wherein the list further indicates a number of 
escalated alarms associated with each of the plurality of network elements. 

22. The method of claim 20 wherein the list further includes a number of 
users currently monitoring each of the plurality of network elements. 
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23. The method of claim 20 wherein the list further includes at least one of 
a total number of alarms associated with each of the plurality of network elements, a 
total number of trouble tickets associated with each of the plurality of network 
elements, a total number of held alarms associated with each of the plurality of 

5 network elements, and a network element type indication for each of the plurality of 
network elements. 

24. A computer-readable medium containing instructions for controlling at 
least one processor to perform a method for managing a network having a plurality of 
network elements, the method comprising: 

receiving a request for network information; 
5 providing a list of network element identifiers associated with the 

plurality of network elements, the list indicating a state of each of the plurality of 
network elements; and 

managing the network using the list. 

25. The computer-readable medium of claim 24 wherein the list further 
includes at least one of a value representing a number of escalated alarms associated 
with each of the plurality of network elements, a value representing a number of users 
currently monitoring each of the plurality of network elements, a total number of 

5 alarms associated with each of the plurality of network elements, a total number of 
trouble tickets associated with each of the plurality of network elements, a total 
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number of held alarms associated with each of the plurality of network elements, and 
a network element type indication for each of the plurality of network elements. 

26. A method for managing a network having a plurality of network 
devices, comprising; 

associating events in the network with one of the plurality of network 

devices; 

providing a geographical map, the geographical map displaying 
locations of each of the plurality of network devices and indicating which of the 
plurality of network devices are associated with at least one event; and 

managing the network using the geographical map. 

27. The method of claim 26 wherein the network devices include points of 
presence and network elements. 

28. The method of claim 26 further comprising: 

selecting a network device having at least one associated event; and 
providing information regarding the at least one associated event. 

29. The method of claim 26 wherein the geographical map further displays 
a state of each network device. 
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30. A device for managing a network having a plurality of network 
devices, comprising: 

a memory configured to store instructions; and 

a processor configured to execute the instructions to associate an event 
in the network with a network device and provide a geographical map, the 
geographical map displaying locations of network devices and indicating which 
network devices are associated with at least one event. 

31. The device of claim 30 wherein the network devices include points of 
presence and network elements. 

32. The device of claim 30 wherein the processor is further configured to: 
provide event information in response to selection of a network device 

having at least one event associated therewith. 

33. The device of claim 30 wherein the processor is further configured to: 
display a state of each network device on the geographical map. 

34. A computer-readable medium containing instructions for controlling at 
least one processor to perform a method for managing a network having a plurality of 
network devices, the method comprising: 
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associating events in the network with one of the plurality of network 

devices; 

providing a geographical map, the geographical map displaying 
locations of each of the plurality of network devices and indicating which of the 
plurality of network devices are associated with at least one event; and 

managing the network using the geographical map. 

35. The computer-readable medium of claim 34 wherein the network 
devices include points of presence and network elements. 

36. The computer-readable medium of claim 34 wherein the method 
further comprises: 

selecting a network device having at least one associated event; and 
providing information regarding the at least one associated event. 

37. The computer-readable medium of claim 34 wherein the geographical 
map further displays a state of each network device. 

38. A device for managing a network having a plurality of network 
elements, comprising: 

a memory configured to store instructions; and 
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a processor configured to execute the instructions to associate each 

network element with one of a plurality of logical planes and provide a network map, 

the network map displaying relationships between the plurality of logical planes and 

those network elements associated with the plurality of logical planes. 

39. The device of claim 38 wherein the plurality of logical planes includes 
one or more of a transmission plane, a switching plane, a customer access plane, and a 
signaling plane. 

40. The device of claim 38 wherein the processor is further configured to: 
allow a user to navigate through the network map. 

41 . The device of claim 38 wherein the processor is further configured to: 
display a state of each network element in the network map. 

42. The device of claim 38 wherein the network map is a three- 
dimensional network map. 

43. A method for managing a network having a plurality of network 
elements, comprising: 

associating each of the plurality of network elements with one of a 
plurality of logical planes; 
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providing a network map, the network map displaying relationships between 
the plurality of logical planes and those network elements associated with the plurality 
of logical planes; and 

managing the network using the network map. 

44. The method of claim 43 wherein the plurality of logical planes includes 
one or more of a transmission plane, a switching plane, a customer access plane, and a 
signaling plane. 



45. The method of claim 43 wherein the managing includes: 
allowing a user to navigate through the network map. 

46. The method of claim 43 wherein the providing includes: 
displaying a state of each network element in the network map. 

47. The method of claim 43 wherein the network map is a three- 
dimensional network map. 

48. A computer-readable medium containing instructions for controlling at 
least one processor to perform a method for managing a network having a plurality of 
network elements, the method comprising: 
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associating each of the plurality of network elements with one of a 
plurality of logical planes; 

providing a network map, the network map displaying relationships 
between the plurality of logical planes and those network elements associated with the 
plurality of logical planes; and 

managing the network using the network map. 

49. A system for managing a network having a plurality of network 
elements, comprising: 

a user device configured to provide a user with a list of network 
management options, the options including a network element diagnostic option, a 
network summary option, a geographical network management option, a three- 
dimensional network management option, transmit, in response to a selection of an 
option by the user, a request for current network information, provide the user with 
current network information according to the selected option; and 

a server configured to receive the request for current network 
information and transmit current network information to the user device. 

50. The system of claim 49 wherein the user device is configured to: 
provide, in response to a selection of the network element diagnostic 

option, a first list of events occurring in the network, and 
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simultaneously provide a second list of events occurring in the 
5 network, the second list comprising a predetermined number of most recent events. 

51. The system of claim 49 wherein the user device is configured to: 
provide, in response to a selection of the network summary option, a 

list of network element identifiers associated with the plurality of network elements, 
each network element identifier being associated with a state indication. 

52. The system of claim 49 wherein the user device is configured to: 
associate, in response to a selection of the geographical network 

management option, events in the network with one of the plurality of network 
devices, and 

5 provide a geographical map, the geographical map displaying locations 

of each of the plurality of network devices and indicating which of the plurality of 
network devices are associated with at least one event. 

53. The system of claim 49 wherein the user device is configured to: 
associate, in response to a selection of the three-dimensional network 

management option, each of the plurality of network elements with one of a plurality 
of logical planes, and 
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5 provide a network map, the network map displaying relationships 

between the plurality of logical planes and those network elements associated with the 
plurality of logical planes. 
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ABSTRACT 

A system (130) improves network management. The system (130) associates 
an event in the network with a network device and provides a geographical map (710). 
The geographical map (710) displays locations of network devices and indicates 
which network devices are associated with at least one event. 
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EXPRESS MAIL NO. EL029404783US 



DECLARATION AND POWER OF ATTORNEY FOR PATENT 

APPLICATION 

Attorney Docket No. 00-8008 



As a below named inventor, I hereby declare that: 

My residence, post office address and citizenship are as stated below next to my name, 

I believe I am the original, first and sole inventor (if only one name is listed below) or an original, first 
and joint inventor (if plural names are listed below) of the subject matter which is claimed and for 
which a patent is sought on the invention entitled: 

SYSTEMS AND METHODS FOR MANAGING FAULTS IN A NETWORK 

the specification of which (check one) [ X ] is attached hereto. [ ] was filed on 
as Appln. Serial No. and was amended on 

( if applicable). I hereby state that I have reviewed and understand the contents of the above identified 
specification, including the claims, as amended by any amendment referred to above. 

I acknowledge the duty to disclose information which is material to the patentability of this application 
in accordance with Title 37, Code of Federal Regulations, Section 1.56(a). 

I hereby claim foreign priority benefits under Title 35, United States Code, Section 119 of any foreign 
application(s) for patent or inventor's certificate listed below and have also identified any foreign 
application for patent or inventor's certificate having a filing date before that of the application on 
which priority is claimed: 

Prior Foreign Application(s) Priority Claimed 

[ _ j Yes [ _ ] No 

(Number) (Country) (Day/Month/Year filed) 

I hereby claim the benefit under Title 35, United States Code, 1 19(e) of any United States provisional 
applications(s) listed below. 



(Application Number) (Filing Date) 

I hereby claim the benefit under Title 35, United States Code, Section 120 of any United States 
application(s) listed below and insofar as the subject matter of each of the claims of this application is 
not disclosed in the prior United States application in the manner provided by the first paragraph of Title 
35, United States Code, Section 112, 1 acknowledge the duty to disclose material information as defined 
in Title 37, Code of Federal Regulations, Section 1.56 which occurred between the filing date of the 
prior application and the national or PCT international filing date for this application: 



(Appln. Serial No.) 



(Filing Date) 



(Status-patented, pending, abandoned) 



Attorney Docket No. 



00-8008 



I hereby appoint the following attorney(s) and/or agent(s) to prosecute this application and to transact all 
business in the Patent and Trademark Office connected therewith: 

Leonard C. Suchyta, Reg. No. 25,707, and James Weixel, Reg. No. 44,399 

Address all telephone calls to James K. Weixel at telephone no. (781) 466-2220 

Address all correspondence to Leonard C. Suchyta 

Verizon Services Group 

600 Hidden Ridge, HQE03G13 

Irving, TX 75038 

I hereby declare that all statements made herein of my own knowledge are true and that all statements 
made on information and belief are believed to be true; and further that these statements were made with 
the knowledge that willful false statements and the like so made are punishable by fine or imprisonment 
or both, under Section 1001 of Title 18 of the United States Code and that such willful false statements ' 
may jeopardize the validity of the application or any patent issued thereon. 
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Post Office Address 71 Cortland Ln., Boxborough, MA 01719 
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Residence Newton, Massachusetts Citizenship Irish 

Post Office Address 25 Irving St, Newton, MA 02459 



FULL NAME OF THIRD INVENTOR MichaelJ. Turok 



Inventor's signature rj ate 



Residence Peabody, Massachusetts Citizenship USA 

Post Office Address 403 Foxwood Cir., Peabody, MA 01960 



FULL NAME OF FOURTH INVENTOR Bruce Wilson 
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Residence Arlington, Massachusetts Citizenship USA 

Post Office Address 183 Wright St., Arlington, MA 02474 



